# MongoDB Atlas IAM and RBAC > Atlas uses a three-tier identity model: Organization → Project → Database. Parent: [MongoDB Atlas](https://llms-explorer.com/tree/mongodb-atlas/) · 18 facets · 74 facts · page: https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/ ## Three-Tier Identity Model - Atlas uses a three-tier identity model: Organization → Project → Database. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#three-tier-identity-model) ## SCRAM-SHA-256 (default) - Username + password. Most compatible. FIPS 140-2 compliant when using SHA-256. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#scram-sha-256-default) ## X.509 Certificates - Client certificate authentication. Two types: — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#x509-certificates) - Atlas-managed: Atlas generates and manages the CA; valid for up to 5 years (configurable) — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#x509-certificates) - Customer-managed (LDAP): Customer operates their own CA; Atlas validates against customer's CA — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#x509-certificates) ## AWS IAM (MONGODB-AWS) - Passwordless auth using AWS credentials (IAM user, role, EC2 instance profile, IRSA, Lambda execution role). — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#aws-iam-mongodb-aws) - Connection string: authMechanism=MONGODB-AWS — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#aws-iam-mongodb-aws) - Create Atlas database user with username = arn:aws:iam:::role/ or arn:aws:iam:::user/ — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#aws-iam-mongodb-aws) ## OIDC / Workload Identity Federation (GA 2024) - Workforce (human users) and Workload (apps/services) identity federation. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#oidc-workload-identity-federation-ga-2024) - Workforce OIDC: Human users SSO into Atlas database access via Entra ID, Okta, Google Workspace, or any OIDC provider. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#oidc-workload-identity-federation-ga-2024) - Workload OIDC: Applications authenticate without passwords using OIDC tokens from GCP, Azure, AWS, or any OIDC provider. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#oidc-workload-identity-federation-ga-2024) ## LDAP (Deprecated in MongoDB 8.0) - LDAP authentication and authorization supported in MongoDB 4.x–7.x. Deprecated in 8.0. Migrate to OIDC or X.509. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#ldap-deprecated-in-mongodb-80) ## Atlas Service Accounts (GA April 2025) - Replaces legacy Programmatic API Keys for machine-to-machine Atlas API access. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) - Client ID + Client Secret → OAuth 2.0 client credentials flow → 1-hour bearer tokens — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) - Scoped at Org or Project level — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) - Supports Workload Identity Federation (WIF) - replace Client Secret with OIDC tokens from GKE/AKS/EKS/Cloud Run — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) - Migration from API Keys to Service Accounts: — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) - Create Service Account in Atlas (Org/Project → Access Manager → Service Accounts) — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) - Generate Client ID + Client Secret (show once) — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) - Update IaC/CI env vars: MONGODB_ATLAS_CLIENT_ID + MONGODB_ATLAS_CLIENT_SECRET — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) - Remove old API key after confirming new SA works — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-service-accounts-ga-april-2025) ## Programmatic API Keys (Legacy) - Public key + private key pair using HTTP Digest. Cannot be rotated atomically. Counted as "users" in the project. Will eventually be deprecated. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#programmatic-api-keys-legacy) - API key IP allowlist: API keys can be restricted to specific IP addresses - important for CI/CD security. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#programmatic-api-keys-legacy) ## Workforce Identity Federation (SAML/OIDC) - Allows organization members to log into the Atlas UI and API using their corporate SSO (Okta, Entra ID, Google Workspace, PingFederate). — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#workforce-identity-federation-samloidc) - SAML: Atlas UI access only. Configure via Organization → Security → Federation Management. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#workforce-identity-federation-samloidc) - OIDC (Workforce): Atlas database access. Configure in Organization → Security → Workforce Identity Provider. Maps IdP group claims to Atlas project roles. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#workforce-identity-federation-samloidc) - Group-to-role mapping: Map IdP group Object IDs to Atlas org/project roles. Groups claim must be present in the token. Large group membership (>150 groups on Entra ID) may omit groups claim - filter to relevant groups. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#workforce-identity-federation-samloidc) ## Custom Database Roles - Extend built-in MongoDB roles with collection-level or action-level granularity. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#custom-database-roles) - Custom roles created at the project level - available across all clusters in the project. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#custom-database-roles) ## Atlas Resource Policies (Cedar Guardrails) - Atlas Resource Policies use Cedar policy language to enforce organization-wide guardrails (GA 2025). Examples: — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-resource-policies-cedar-guardrails) - Restrict cluster creation to specific cloud providers/regions — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-resource-policies-cedar-guardrails) - Require encryption at rest for all clusters — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-resource-policies-cedar-guardrails) - Enforce minimum backup retention — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-resource-policies-cedar-guardrails) - Applied at the organization level; evaluated before any Atlas API mutation. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#atlas-resource-policies-cedar-guardrails) ## Database Auditing - When available: M10+ clusters only. Not available on M0/Flex. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#database-auditing) - Configure audit log filter to capture: authenticate, authCheck (authorization decisions), createCollection, dropCollection, createDatabase, dropDatabase. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#database-auditing) - SIEM integration: Push Atlas audit logs to Datadog, Sumo Logic, S3, or via Atlas Admin API log pull. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#database-auditing) - Activity Feed: Organization and project-level audit trail of Atlas control-plane actions (cluster creates, user changes, backup events) - accessible even on M0/Flex. — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#database-auditing) ## Common Debugging Scenarios - "Authentication failed" for new database user: — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Verify user exists in the correct project (users are project-scoped) — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Verify the auth database is admin for SCRAM users — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Verify password does not contain special characters needing URL encoding — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Verify IP allowlist includes the client IP — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - "Authorization failed" after auth succeeds: — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Check which roles are assigned to the user — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Verify role is scoped to the correct database/collection — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Custom roles: check actions and resources are correct — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - AWS IAM: verify the role ARN matches exactly (account ID + role name) — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - OIDC token rejected: — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Decode JWT: check iss claim matches Atlas Workload IDP issuer config — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Check aud claim matches Atlas IDP audience field — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) - Check token exp hasn't passed (clock skew > 5 min causes failures) — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#common-debugging-scenarios) ## References - Atlas Database Users — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#references) - Atlas Service Accounts — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#references) - Workforce Identity Federation — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#references) - Workload Identity Federation — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#references) - Atlas Resource Policies — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#references) - Database Auditing — [source](https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-iam-rbac/#references) ## Where this helps - Designing passwordless, machine-to-machine authentication for an application running on AWS, GCP, or Azure compute, using AWS IAM or OIDC Workload Identity Federation instead of static database credentials. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Migrating CI/CD and IaC automation off legacy Programmatic API Keys onto Atlas Service Accounts with OAuth 2.0 client credentials. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Rolling out corporate SSO, such as Okta or Entra ID, for human access to both the Atlas UI and the underlying databases via Workforce Identity Federation. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Debugging an "Authorization failed" error after authentication succeeds, which usually traces to role scope, custom-role actions, or, for OIDC, a claims/audience mismatch. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* ## Project ideas - Migrate a CI/CD pipeline from legacy Programmatic API Keys to an Atlas Service Account using OAuth 2.0 client credentials, and add Workload Identity Federation so no client secret is stored at all. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Design a custom database role that grants collection-level, action-level access narrower than any built-in role, for a service that should only read one collection. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Build an org-wide Atlas Resource Policy (Cedar guardrail) that restricts cluster creation to approved cloud providers/regions and requires encryption at rest. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Set up Workforce OIDC federation so engineers authenticate to database access with their corporate SSO identity instead of a shared SCRAM credential. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* ## Antipatterns - Continuing to build new integrations on LDAP authentication, which is deprecated as of MongoDB 8.0 in favor of OIDC or X.509. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Relying on legacy Programmatic API Keys for new automation instead of Service Accounts, when API keys can't be rotated atomically and count as project "users." — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Mapping an OIDC group claim without accounting for large group membership — Entra ID can omit the groups claim entirely above roughly 150 groups, silently breaking group-to-role mapping. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Treating Atlas users and database users as the same identity — they access different planes, control plane vs. data plane, and have to be reasoned about separately. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* ## Known issues - Database Auditing is only available on M10+ clusters, not on M0 or Flex, so audit-log-based compliance controls can't be applied uniformly across every tier. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - X.509 customer-managed certificates require the customer to operate their own CA, which adds real operational burden compared to Atlas-managed certificates that are valid up to 5 years. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - OIDC token failures are commonly caused by clock skew greater than about 5 minutes between the token issuer and Atlas, which can look like a configuration bug rather than a clock problem. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* - Custom database roles are created at the project level, so a role designed for one project has to be recreated, not simply shared, in another project. — [source](https://llms-explorer.com/tree/mongodb-atlas-iam-and-rbac/) *(AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.)* ## Context files - [MongoDB Atlas IAM and RBAC](https://llms-explorer.com/downloads/sources/mdb-context-hub/mongodb-atlas-iam-rbac.md)